Overview
What Connect with PortModels gives your app, and which flow to pick.
Connect lets your app's users link their PortModels account to your app. Once connected, your backend holds an access token that can — depending on the scopes the user approved — run AI models billed to their credits (with your app's markup as your revenue), store per-user data, and read and write a per-user file folder.
It is a standard OAuth 2.0 authorization-code flow. Confidential clients (your
backend holds a client_secret) and public clients (no secret — desktop and
CLI apps, via PKCE or the device flow) are both supported.
One app connection can have several live access tokens. A login on device B does not sign out device A: each successful authorization or device-flow login gets its own token and keeps the scopes approved for that login. Disconnecting the app from Settings → Connected apps revokes every token for that app and user.
What you get#
| Capability | Scope | Endpoint |
|---|---|---|
| Who the user is | profile.read | GET /connect/userinfo |
| The user's email address | profile.email | GET /connect/userinfo |
| Run models on their credits | models.run | POST /openai/v1/chat/completions |
| Per-user key/value storage | kv.read / kv.write | /connect/kv |
| Per-user file folder | files.read / files.write | /connect/files |
Which flow do I need?#
| Your app | Flow | Why |
|---|---|---|
| Web app with a backend | Authorization code | Your server can keep a client_secret |
| Browser-only app, no backend | PKCE | No secret to leak |
| Desktop app | PKCE | Can open a browser and receive a redirect |
| CLI, TV, headless | Device flow | No redirect available at all |
Isolation#
KV entries and files are namespaced per (app, user). You can never see data another app stored for the same user, and users can revoke your connection at any time from Settings → Connected apps — the access token dies immediately.
Hosts#
The browser consent page is served at
https://app.portmodels.com/connect/authorize. Token exchange, device
authorization/polling, protected Connect resources, and model calls go to
https://api.portmodels.com. The examples use both hosts deliberately; do not
send the browser consent URL to the API host.
Substitute your frontend and API hosts separately if you are running against a beta or local server.
Next#
- Enable Connect on your app.
- Pick a flow from the table above.
- Use the token.